536e8b1207df3afebfae5d4d9f19e33948c04967c322ae1c02fae00bc3695346

Analysis

max time kernel
10s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-02-2025 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bootstrapper/ffmpeg.dll
Size

3.8MB
MD5

bf759c99c1f327c821fcf193239bed34
SHA1

e541b6baaa86f9eec7eb296985d367f1d61ff13a
SHA256

183cd7011c36648ee6dffda0e4bb8042d5ad5db69c1c69a016dcd6412be3e8fb
SHA512

f061920dc2ff2c17dfc023e90c88dca45fe76bfdba6d3bea5a7406dd4ee7ba84b9b1ce4c13afc8e344b4f0cfcab62ad5e9980d07f95769a97d169900fbf56650
SSDEEP

49152:sn/DoMHCR/shZ6NecOjg7J8hoREUq3mdNJHKikD+o+1HuhoH5HDDEDMZAYXRfGeo:SCDouex

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Runs regedit.exe 1 IoCs

pid	Process
2768	regedit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3008	2248	rundll32.exe	31
PID 2248 wrote to memory of 3008	2248	rundll32.exe	31
PID 2248 wrote to memory of 3008	2248	rundll32.exe	31
PID 2248 wrote to memory of 3008	2248	rundll32.exe	31
PID 2248 wrote to memory of 3008	2248	rundll32.exe	31
PID 2248 wrote to memory of 3008	2248	rundll32.exe	31
PID 2248 wrote to memory of 3064	2248	rundll32.exe	32
PID 2248 wrote to memory of 3064	2248	rundll32.exe	32
PID 2248 wrote to memory of 3064	2248	rundll32.exe	32
PID 2248 wrote to memory of 3064	2248	rundll32.exe	32
PID 2248 wrote to memory of 2268	2248	rundll32.exe	33
PID 2248 wrote to memory of 2268	2248	rundll32.exe	33
PID 2248 wrote to memory of 2268	2248	rundll32.exe	33
PID 2248 wrote to memory of 2268	2248	rundll32.exe	33
PID 2248 wrote to memory of 2268	2248	rundll32.exe	33
PID 2248 wrote to memory of 2268	2248	rundll32.exe	33
PID 2248 wrote to memory of 2952	2248	rundll32.exe	34
PID 2248 wrote to memory of 2952	2248	rundll32.exe	34
PID 2248 wrote to memory of 2952	2248	rundll32.exe	34
PID 2248 wrote to memory of 2952	2248	rundll32.exe	34
PID 2248 wrote to memory of 2952	2248	rundll32.exe	34
PID 2248 wrote to memory of 2952	2248	rundll32.exe	34
PID 2248 wrote to memory of 3048	2248	rundll32.exe	35
PID 2248 wrote to memory of 3048	2248	rundll32.exe	35
PID 2248 wrote to memory of 3048	2248	rundll32.exe	35
PID 2248 wrote to memory of 3048	2248	rundll32.exe	35
PID 2248 wrote to memory of 3048	2248	rundll32.exe	35
PID 2248 wrote to memory of 3048	2248	rundll32.exe	35
PID 2248 wrote to memory of 2468	2248	rundll32.exe	36
PID 2248 wrote to memory of 2468	2248	rundll32.exe	36
PID 2248 wrote to memory of 2468	2248	rundll32.exe	36
PID 2248 wrote to memory of 2468	2248	rundll32.exe	36
PID 2248 wrote to memory of 2468	2248	rundll32.exe	36
PID 2248 wrote to memory of 2736	2248	rundll32.exe	37
PID 2248 wrote to memory of 2736	2248	rundll32.exe	37
PID 2248 wrote to memory of 2736	2248	rundll32.exe	37
PID 2248 wrote to memory of 2736	2248	rundll32.exe	37
PID 2248 wrote to memory of 2736	2248	rundll32.exe	37
PID 2248 wrote to memory of 2816	2248	rundll32.exe	38
PID 2248 wrote to memory of 2816	2248	rundll32.exe	38
PID 2248 wrote to memory of 2816	2248	rundll32.exe	38
PID 2248 wrote to memory of 2816	2248	rundll32.exe	38
PID 2248 wrote to memory of 2816	2248	rundll32.exe	38
PID 2248 wrote to memory of 2980	2248	rundll32.exe	39
PID 2248 wrote to memory of 2980	2248	rundll32.exe	39
PID 2248 wrote to memory of 2980	2248	rundll32.exe	39
PID 2248 wrote to memory of 2980	2248	rundll32.exe	39
PID 2248 wrote to memory of 2980	2248	rundll32.exe	39
PID 2248 wrote to memory of 2732	2248	rundll32.exe	40
PID 2248 wrote to memory of 2732	2248	rundll32.exe	40
PID 2248 wrote to memory of 2732	2248	rundll32.exe	40
PID 2248 wrote to memory of 2732	2248	rundll32.exe	40
PID 2248 wrote to memory of 2732	2248	rundll32.exe	40
PID 2248 wrote to memory of 2732	2248	rundll32.exe	40
PID 2248 wrote to memory of 2284	2248	rundll32.exe	41
PID 2248 wrote to memory of 2284	2248	rundll32.exe	41
PID 2248 wrote to memory of 2284	2248	rundll32.exe	41
PID 2248 wrote to memory of 2284	2248	rundll32.exe	41
PID 2248 wrote to memory of 2284	2248	rundll32.exe	41
PID 2248 wrote to memory of 2284	2248	rundll32.exe	41
PID 2248 wrote to memory of 2768	2248	rundll32.exe	42
PID 2248 wrote to memory of 2768	2248	rundll32.exe	42
PID 2248 wrote to memory of 2768	2248	rundll32.exe	42
PID 2248 wrote to memory of 2768	2248	rundll32.exe	42

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bootstrapper\ffmpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:3008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:3064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:2268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2952
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:3048
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:2468
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:2736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2816
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2980
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:2732
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2284
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:2768
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3008-0-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3008-2-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download